Facebook is not content to use the contact information you willingly put into your Facebook profile for advertising.
It is also using contact information you handed over for security purposes and contact information you didn't hand over at all, but that was collected from other people's contact books, a hidden layer of details Facebook has about you that I've come to call "shadow contact information." I managed to place an ad in front of Alan Mislove by targeting his shadow profile.
Hopefully your simple password is not being reused with other online entities. There is a growing number of products, websites and apps that offer two-factor and multi-factor authentication.
Whether it’s just two factors, or three or more — MFA in general is the way to make our accounts much much harder for attackers to break into -- the time to get familiar with these new security measures is now.
2FA is a subset of MFA, and you can read more on the difference between the two in Chris Webber's blog, Two-Factor vs. Online sites can have users' passwords leaked by a hacker. Without an additional factor to your password to confirm your identity, all a malicious user needs is your password to gain access.